Skip to content

v0.2.8 — #63–#66 security mirror

Choose a tag to compare

View all tags
@maskshell maskshell released this 14 Sep 05:11
· 15 commits to master since this release
v0.2.8
This tag was signed with the committer’s verified signature.
maskshell Mask
GPG key ID: 1F64B884BEE2E101
Verified
Learn about vigilant mode.
763b62c
This commit was signed with the committer’s verified signature.
maskshell Mask
GPG key ID: 1F64B884BEE2E101
Verified
Learn about vigilant mode.

Security release

The #63–#66 mirror of upstream CC 8a19c2e: seven ad-hoc project-local tool-resolution sites collapsed onto the canonical dt.resolve_tool — PATH-wins, explicit opt-ins (SF_PROJECT_NODE_BIN / SF_PROJECT_VENV_TOOLS), realpath containment. Before this, arch_contract_web/tests/deps, spectral_adapter, arch_contract_python (private unconditional venv resolver) and fast_gate's eslint site executed repo-committed binaries under gate authority, preferred over PATH — our tree was local-first, worse than CC's pre-fix ordering.

Also: the npx --no-install delegation arm is gated (a PATH tool is not PATH resolution); all converted legs execute with the resolved prefix (check/execution agreement); upstream's 26-probe test suite adopted verbatim; outer-ring reviewed (caught + fixed a govulncheck execution-site miss).

Deferred #67-#69 absorption candidates (web-claim-verifier agent, csr engine semantics, profile bumps) remain ledgered, unprioritized.

Assets 2
Loading